Extracted

• • Target
    booking payments.exe
  • Size 1.0MB
  • SHA256 a943fc4408c2f59f2df0afabf3836e5adae92a8f4a4b1da0270e313d8ea78445
  • MD5 cd4c0048444fce1f2199415a474fdba8
  • SHA1 88efdffd6819d63ac4cca898b13ab3c01553ed26
  • SHA512 5a1588d8983efb6655cd52bbf8eac211c28160433e0a004705f7679af4b2f6f28416bdefba7f33a0106f3bee15945084b70de3d308f0ad7f418a4f24b4c1fd04
  • MD5 SHA1 SHA512

  Score

  10^/10

  rattrojanspywarestealerformbookpersistence

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Formbook Payload

    rat

  • Adds policy Run key to start application

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2